summaryrefslogtreecommitdiff
path: root/Test/dafny1/FindZero.dfy
blob: 374555b020800f3d5382425123a5e0d3245f94fe (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
// RUN: %diff "%s.expect" "%t"

method FindZero(a: array<int>) returns (r: int)
  requires a != null && forall i :: 0 <= i < a.Length ==> 0 <= a[i];
  requires forall i {:nowarn} :: 0 <= i && i+1 < a.Length ==> a[i]-1 <= a[i+1];
  ensures 0 <= r ==> r < a.Length && a[r] == 0;
  ensures r < 0 ==> forall i :: 0 <= i < a.Length ==> a[i] != 0;
{
  var n := 0;
  while (n < a.Length)
    invariant forall i :: 0 <= i < n && i < a.Length ==> a[i] != 0;
  {
    if (a[n] == 0) { r := n; return; }
    Lemma(a, n, a[n]);
    n := n + a[n];
  }
  r := -1;
}

lemma Lemma(a: array<int>, k: int, m: int)
  requires a != null && forall i :: 0 <= i < a.Length ==> 0 <= a[i];
  requires forall i {:nowarn} :: 0 <= i && i+1 < a.Length ==> a[i]-1 <= a[i+1];
  requires 0 <= k;
  requires k < a.Length ==> m <= a[k];
  ensures forall i :: k <= i < k+m && i < a.Length ==> a[i] != 0;
  decreases m;
{
  if (0 < m && k < a.Length) {
    assert a[k] != 0;
    Lemma(a, k+1, m-1);
  }
}

// -----------------------------------------------------------------

method FindZero_GhostLoop(a: array<int>) returns (r: int)
  requires a != null && forall i :: 0 <= i < a.Length ==> 0 <= a[i];
  requires forall i {:nowarn} :: 0 <= i && i+1 < a.Length ==> a[i]-1 <= a[i+1];
  ensures 0 <= r ==> r < a.Length && a[r] == 0;
  ensures r < 0 ==> forall i :: 0 <= i < a.Length ==> a[i] != 0;
{
  var n := 0;
  while (n < a.Length)
    invariant forall i :: 0 <= i < n && i < a.Length ==> a[i] != 0;
  {
    if (a[n] == 0) { return n; }
    ghost var m := n;
    while (m < n + a[n])
      invariant m <= n + a[n] && m < a.Length;
      invariant n + a[n] - m <= a[m];
      invariant forall i :: 0 <= i < m && i < a.Length ==> a[i] != 0;
    {
      m := m + 1;
      if (m == a.Length) { break; }
    }
    n := n + a[n];
  }
  return -1;
}

// -----------------------------------------------------------------

method FindZero_Assert(a: array<int>) returns (r: int)
  requires a != null && forall i :: 0 <= i < a.Length ==> 0 <= a[i];
  requires forall i {:nowarn} :: 0 <= i-1 && i < a.Length ==> a[i-1]-1 <= a[i];
  ensures 0 <= r ==> r < a.Length && a[r] == 0;
  ensures r < 0 ==> forall i :: 0 <= i < a.Length ==> a[i] != 0;
{
  var n := 0;
  while (n < a.Length)
    invariant forall i :: 0 <= i < n && i < a.Length ==> a[i] != 0;
  {
    if (a[n] == 0) { return n; }
    assert forall m {:induction} :: n <= m < n + a[n] && m < a.Length ==> n+a[n]-m <= a[m];
    n := n + a[n];
  }
  return -1;
}